fix: seed docs i18n codex auth

scripts/docs-i18n/translator.go

@@ -3,6 +3,7 @@ package main
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
@@ -189,11 +190,15 @@ func runCodexExecPrompt(ctx context.Context, req codexPromptRequest) (string, er
 		return "", err
 	}
 	defer os.RemoveAll(codexHome)
+	if err := writeCodexAuthFile(codexHome); err != nil {
+		return "", err
+	}
 
 	args := []string{
 		"exec",
 		"--model", req.Model,
 		"-c", fmt.Sprintf("model_reasoning_effort=%q", normalizeThinking(req.Thinking)),
+		"-c", `service_tier="fast"`,
 		"--sandbox", "read-only",
 		"--ignore-rules",
 		"--skip-git-repo-check",
@@ -222,6 +227,21 @@ func runCodexExecPrompt(ctx context.Context, req codexPromptRequest) (string, er
 	return translated, nil
 }
 
+func writeCodexAuthFile(codexHome string) error {
+	apiKey := strings.TrimSpace(os.Getenv("OPENAI_API_KEY"))
+	if apiKey == "" {
+		return nil
+	}
+	data, err := json.Marshal(map[string]string{
+		"auth_mode":      "apikey",
+		"OPENAI_API_KEY": apiKey,
+	})
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(filepath.Join(codexHome, "auth.json"), append(data, '\n'), 0o600)
+}
+
 func isolatedCodexHomeBase() (string, error) {
 	cacheDir, err := os.UserCacheDir()
 	if err != nil || strings.TrimSpace(cacheDir) == "" {

scripts/docs-i18n/translator_test.go

@@ -141,18 +141,53 @@ func TestRunCodexExecPromptUsesOutputLastMessage(t *testing.T) {
 	if err := os.WriteFile(fakeCodex, []byte(`#!/bin/sh
 set -eu
 out=""
+saw_effort=0
+saw_service=0
 while [ "$#" -gt 0 ]; do
-  if [ "$1" = "--output-last-message" ]; then
-    shift
-    out="$1"
-  fi
+  case "$1" in
+    --output-last-message)
+      shift
+      out="$1"
+      ;;
+    -c|--config)
+      shift
+      case "$1" in
+        model_reasoning_effort=\"high\")
+          saw_effort=1
+          ;;
+        service_tier=\"fast\")
+          saw_service=1
+          ;;
+      esac
+      ;;
+  esac
   shift || true
 done
 cat >/dev/null
+if [ "$saw_effort" != "1" ]; then
+  echo "missing high reasoning effort config" >&2
+  exit 1
+fi
+if [ "$saw_service" != "1" ]; then
+  echo "missing fast service tier config" >&2
+  exit 1
+fi
 if [ -z "${CODEX_HOME:-}" ]; then
   echo "missing CODEX_HOME" >&2
   exit 1
 fi
+if [ ! -f "$CODEX_HOME/auth.json" ]; then
+  echo "missing auth.json" >&2
+  exit 1
+fi
+if ! grep -q '"auth_mode":"apikey"' "$CODEX_HOME/auth.json"; then
+  echo "auth.json missing apikey mode" >&2
+  exit 1
+fi
+if ! grep -q '"OPENAI_API_KEY":"test-openai-key"' "$CODEX_HOME/auth.json"; then
+  echo "auth.json missing API key" >&2
+  exit 1
+fi
 case "$CODEX_HOME" in
   /tmp/*)
     echo "CODEX_HOME must not be under /tmp" >&2
@@ -164,6 +199,7 @@ printf 'translated from codex\n' > "$out"
 		t.Fatalf("write fake codex: %v", err)
 	}
 	t.Setenv(envDocsI18nCodexExecutable, fakeCodex)
+	t.Setenv("OPENAI_API_KEY", "test-openai-key")
 
 	got, err := runCodexExecPrompt(context.Background(), codexPromptRequest{
 		SystemPrompt: "Translate.",